diff --git a/webserver/docker_mail/defaults/main.yaml b/webserver/docker_mail/defaults/main.yaml
index b1d3de938ab2ac296d552ac7a34d1d9223f881ad..8c56cf91d8145fcaaefd2efa7a61f02267317332 100644
--- a/webserver/docker_mail/defaults/main.yaml
+++ b/webserver/docker_mail/defaults/main.yaml
@@ -1,4 +1,3 @@
---
servicename: mail
basedir: /srv/mail
-gitdir: mailcow-mailman3-dockerized
diff --git a/webserver/docker_mail/tasks/main.yaml b/webserver/docker_mail/tasks/main.yaml
index 2462f71990a6f9a674ad28e42a0c886e9899caf6..ab8279dcaa0572260780028d11a31f78dcb7ae1c 100644
--- a/webserver/docker_mail/tasks/main.yaml
+++ b/webserver/docker_mail/tasks/main.yaml
@@ -6,7 +6,7 @@
- { path: "{{ basedir }}/secrets/mysql_root_pass", length: 28 }
- { path: "{{ basedir }}/secrets/hyperkitty_api_key", length: 28 }
- { path: "{{ basedir }}/secrets/mysql_mailman_pass", length: 28 }
- - { path: "{{ basedir }}/secrets/mailman_decret_key", length: 28 }
+ - { path: "{{ basedir }}/secrets/mailman_secret_key", length: 28 }
- name: "create folder struct for {{ servicename }}"
@@ -24,8 +24,6 @@
- "{{ basedir }}/data/postfix"
- "{{ basedir }}/data/sogo-web"
- "{{ basedir }}/data/sogo-userdata-backup"
- - "{{ basedir }}/data/mailman-core"
- - "{{ basedir }}/data/mailman-database"
- name: "create folder struct for {{ servicename }} 2"
@@ -38,86 +36,75 @@
with_items:
- "{{ basedir }}/data/crypt"
- "{{ basedir }}/data/vmail"
- - "{{ basedir }}/data/vmail-attachments"
+ - "{{ basedir }}/data/vmail-index"
-
-- name: Git checkout mailcow+mailman-dockerized
+
+- name: Git checkout mailcow
git:
- repo: 'https://github.com/Shadowghost/mailcow-mailman3-dockerized.git'
- dest: "{{ basedir }}/{{ gitdir }}"
- version: 7c9e89dce588568c5b528b3b9d0e01f42e485952
- # Current version at 2020-11-04
+ repo: 'https://github.com/mailcow/mailcow-dockerized.git'
+ dest: "{{ basedir }}/mailcow-dockerized"
+ version: 08396dc63a3299f4fd35c7eaf163c805292bb27c
+ # current version 2020-11-11
+
+- name: Git checkout mailman-dockerized
+ git:
+ repo: 'https://github.com/maxking/docker-mailman'
+ dest: "{{ basedir }}/docker-mailman.git"
+ version: v0.3.9
+ # current version 2020-11-11
-
-- name: "create folder struct for {{ servicename }} 3"
- file:
- path: "{{ item }}"
- state: "directory"
- with_items:
- - "{{ basedir }}/{{ gitdir }}/data/assets/ssl/"
-
-# DH Parameter erzeugen
-- name: check if DH Params exists
- stat:
- path: "{{ basedir }}/{{ gitdir }}/data/assets/ssl/dhparams.pem"
- register: dhparams
-
-- name: generate new DH Params
- command: "openssl dhparam -out {{ basedir }}/{{ gitdir }}/data/assets/ssl/dhparams.pem 2048"
- when: dhparams.stat.exists == False
-
-
-# Copy files from letsencrypt (temp until switch to traefik)
-- name: copy cert.pem from letsencrypt (temp until switch to traefik)
- copy:
- remote_src: yes
- src: /etc/letsencrypt/live/mailserver.warpzone.ms/cert.pem
- dest: "{{ basedir }}/{{ gitdir }}/data/assets/ssl/cert.pem"
-
-- name: copy chain.pem from letsencrypt (temp until switch to traefik)
- copy:
- remote_src: yes
- src: /etc/letsencrypt/live/mailserver.warpzone.ms/chain.pem
- dest: "{{ basedir }}/{{ gitdir }}/data/assets/ssl/chain.pem"
-
-- name: copy key.pem files from letsencrypt (temp until switch to traefik)
- copy:
- remote_src: yes
- src: /etc/letsencrypt/live/mailserver.warpzone.ms/privkey.pem
- dest: "{{ basedir }}/{{ gitdir }}/data/assets/ssl/key.pem"
-
-
-# Copy config files
-- name: deploy enviroment file
- template:
- dest: "{{ basedir }}/{{ gitdir }}/.env"
- src: "env"
- mode: 0644
- register: env
-# TODO: mailmam-extra.cfg Upstream PR
-- name: deploy config files
+# - name: "create folder struct for {{ servicename }} 3"
+# file:
+# path: "{{ item }}"
+# state: "directory"
+# with_items:
+# - "{{ basedir }}/{{ gitdir }}/data/assets/ssl/"
+
+# DH Parameter erzeugen
+# - name: check if DH Params exists
+# stat:
+# path: "{{ basedir }}/{{ gitdir }}/data/assets/ssl/dhparams.pem"
+# register: dhparams
+
+# - name: generate new DH Params
+# command: "openssl dhparam -out {{ basedir }}/{{ gitdir }}/data/assets/ssl/dhparams.pem 2048"
+# when: dhparams.stat.exists == False
+
+# Copy config files
+- name: deploy mailcow config
template:
- dest: "{{ basedir }}/{{ gitdir }}/{{ item }}"
+ dest: "{{ basedir }}/{{ item }}"
src: "{{ item }}"
mode: 0644
with_items:
- - docker-compose.override.yml
- - data/mailman/core/mailman-extra.cfg
- register: config
+ - mailcow-dockerized/mailcow.conf
+ - mailcow-dockerized/docker-compose.override.yml
+ register: env
+
+# # TODO: mailmam-extra.cfg Upstream PR
+# - name: deploy config files
+# template:
+# dest: "{{ basedir }}/{{ gitdir }}/{{ item }}"
+# src: "{{ item }}"
+# mode: 0644
+# with_items:
+# - docker-compose.override.yml
+# - data/mailman/core/mailman-extra.cfg
+# register: config
+
+
+# # Start containers
+# - name: "stop {{ servicename }} docker"
+# docker_compose:
+# project_src: "{{ basedir }}/{{ gitdir }}"
+# state: absent
+# when: env.changed or config.changed
-# Start containers
-- name: "stop {{ servicename }} docker"
- docker_compose:
- project_src: "{{ basedir }}/{{ gitdir }}"
- state: absent
- when: env.changed or config.changed
-
# - name: "start {{ servicename }} docker"
# docker_compose:
# project_src: "{{ basedir }}/{{ gitdir }}"
# state: present
-
\ No newline at end of file
diff --git a/webserver/docker_mail/templates/mailcow-dockerized/docker-compose.override.yml b/webserver/docker_mail/templates/mailcow-dockerized/docker-compose.override.yml
new file mode 100644
index 0000000000000000000000000000000000000000..ae9a4d20c0cc2ac85a30e045b61743a6c292da91
--- /dev/null
+++ b/webserver/docker_mail/templates/mailcow-dockerized/docker-compose.override.yml
@@ -0,0 +1,125 @@
+version: '2.1'
+
+services:
+ traefik-certdumper:
+ image: humenius/traefik-certs-dumper
+ network_mode: none
+ command: --restart-containers mail_dovecot-milcow_1,mail_postfix-mailcow_1,mail_nginx-mailcow_1,mail_watchdog-mailcow_1
+ volumes:
+ # mount the folder which contains Traefik's `acme.json' file
+ - /srv/traefik/acme.json:/traefik/acme.json:ro
+ # mount mailcow's SSL folder
+ - ./data/assets/ssl/:/output:rw
+ # Docker API for Container restart
+ - /var/run/docker.sock:/var/run/docker.sock:ro
+ environment:
+ # only change this, if you're using another domain for mailcow's web frontend compared to the standard config
+ - DOMAIN=${MAILCOW_HOSTNAME}
+
+ nginx-mailcow:
+ labels:
+ - traefik.enable=true
+ - traefik.http.routers.{{ servicename }}-mailcow.rule=Host(`${MAILCOW_HOSTNAME}`)
+ - traefik.http.routers.{{ servicename }}-mailcow.entrypoints=websecure
+ - traefik.http.services.{{ servicename }}-mailcow.loadbalancer.server.port=42012
+ networks:
+ mailcow-network:
+ aliases:
+ - nginx
+ - sogo
+ web:
+ aliases:
+ - nginx
+
+ # Container anpassen um start zu unterbinden
+ clamd-mailcow:
+ image: stakater/exit-container
+ restart: 'no'
+
+ sogo-mailcow:
+ image: stakater/exit-container
+ restart: 'no'
+
+ acme-mailcow:
+ image: stakater/exit-container
+ restart: 'no'
+
+ solr-mailcow:
+ image: stakater/exit-container
+ restart: 'no'
+
+networks:
+ web:
+ external: true
+
+# Volumes auf lokale Verzeichnise umlenken
+
+volumes:
+ # Storage for email files
+ vmail-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/vmail"
+ # Storage for index (deduplicated)
+ vmail-index-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/vmail-index"
+ mysql-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/mysql"
+ mysql-socket-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/mysql-socket"
+ redis-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/redis"
+ rspamd-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/rspamd"
+ solr-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/solr"
+ postfix-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/postfix"
+ crypt-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/crypt"
+ sogo-web-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/sogo-web"
+ sogo-userdata-backup-vol-1:
+ driver: local
+ driver_opts:
+ o: bind
+ type: none
+ device: "{{ basedir }}/data/sogo-userdata-backup"
diff --git a/webserver/docker_mail/templates/mailcow-dockerized/docker-compose.yml b/webserver/docker_mail/templates/mailcow-dockerized/docker-compose.yml
new file mode 100644
index 0000000000000000000000000000000000000000..d9251a289b27911edac707b5043fdfea1f56f6ec
--- /dev/null
+++ b/webserver/docker_mail/templates/mailcow-dockerized/docker-compose.yml
@@ -0,0 +1,571 @@
+version: '2.1'
+services:
+
+ unbound-mailcow:
+ image: mailcow/unbound:1.12
+ environment:
+ - TZ=${TZ}
+ volumes:
+ - ./data/hooks/unbound:/hooks:Z
+ - ./data/conf/unbound/unbound.conf:/etc/unbound/unbound.conf:ro,Z
+ restart: always
+ tty: true
+ networks:
+ mailcow-network:
+ ipv4_address: ${IPV4_NETWORK:-172.22.1}.254
+ aliases:
+ - unbound
+
+ mysql-mailcow:
+ image: mariadb:10.4
+ depends_on:
+ - unbound-mailcow
+ stop_grace_period: 45s
+ volumes:
+ - mysql-vol-1:/var/lib/mysql/:Z
+ - mysql-socket-vol-1:/var/run/mysqld/:z
+ - ./data/conf/mysql/:/etc/mysql/conf.d/:ro,Z
+ environment:
+ - TZ=${TZ}
+ - MYSQL_ROOT_PASSWORD=${DBROOT}
+ - MYSQL_DATABASE=${DBNAME}
+ - MYSQL_USER=${DBUSER}
+ - MYSQL_PASSWORD=${DBPASS}
+ - MYSQL_INITDB_SKIP_TZINFO=1
+ restart: always
+ ports:
+ - "${SQL_PORT:-127.0.0.1:13306}:3306"
+ networks:
+ mailcow-network:
+ aliases:
+ - mysql
+
+ redis-mailcow:
+ image: redis:5-alpine
+ volumes:
+ - redis-vol-1:/data/:Z
+ restart: always
+ ports:
+ - "${REDIS_PORT:-127.0.0.1:7654}:6379"
+ environment:
+ - TZ=${TZ}
+ networks:
+ mailcow-network:
+ ipv4_address: ${IPV4_NETWORK:-172.22.1}.249
+ aliases:
+ - redis
+
+ clamd-mailcow:
+ image: mailcow/clamd:1.37
+ restart: always
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ environment:
+ - TZ=${TZ}
+ - SKIP_CLAMD=${SKIP_CLAMD:-n}
+ volumes:
+ - ./data/conf/clamav/:/etc/clamav/:Z
+ networks:
+ mailcow-network:
+ aliases:
+ - clamd
+
+ rspamd-mailcow:
+ image: mailcow/rspamd:1.74
+ stop_grace_period: 30s
+ depends_on:
+ - dovecot-mailcow
+ environment:
+ - TZ=${TZ}
+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
+ - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ volumes:
+ - ./data/hooks/rspamd:/hooks:Z
+ - ./data/conf/rspamd/custom/:/etc/rspamd/custom:z
+ - ./data/conf/rspamd/override.d/:/etc/rspamd/override.d:Z
+ - ./data/conf/rspamd/local.d/:/etc/rspamd/local.d:Z
+ - ./data/conf/rspamd/plugins.d/:/etc/rspamd/plugins.d:Z
+ - ./data/conf/rspamd/lua/:/etc/rspamd/lua/:ro,Z
+ - ./data/conf/rspamd/rspamd.conf.local:/etc/rspamd/rspamd.conf.local:Z
+ - ./data/conf/rspamd/rspamd.conf.override:/etc/rspamd/rspamd.conf.override:Z
+ - rspamd-vol-1:/var/lib/rspamd:z
+ restart: always
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ hostname: rspamd
+ networks:
+ mailcow-network:
+ aliases:
+ - rspamd
+
+ php-fpm-mailcow:
+ image: mailcow/phpfpm:1.69
+ command: "php-fpm -d date.timezone=${TZ} -d expose_php=0"
+ depends_on:
+ - redis-mailcow
+ volumes:
+ - ./data/hooks/phpfpm:/hooks:Z
+ - ./data/web:/web:rw,z
+ - ./data/conf/rspamd/dynmaps:/dynmaps:ro,z
+ - ./data/conf/rspamd/custom/:/rspamd_custom_maps:z
+ - rspamd-vol-1:/var/lib/rspamd:z
+ - mysql-socket-vol-1:/var/run/mysqld/:z
+ - ./data/conf/sogo/:/etc/sogo/:z
+ - ./data/conf/rspamd/meta_exporter:/meta_exporter:ro,z
+ - ./data/conf/phpfpm/sogo-sso/:/etc/sogo-sso/:z
+ - ./data/conf/phpfpm/php-fpm.d/pools.conf:/usr/local/etc/php-fpm.d/z-pools.conf:Z
+ - ./data/conf/phpfpm/php-conf.d/opcache-recommended.ini:/usr/local/etc/php/conf.d/opcache-recommended.ini:Z
+ - ./data/conf/phpfpm/php-conf.d/upload.ini:/usr/local/etc/php/conf.d/upload.ini:Z
+ - ./data/conf/phpfpm/php-conf.d/other.ini:/usr/local/etc/php/conf.d/zzz-other.ini:Z
+ - ./data/conf/dovecot/global_sieve_before:/global_sieve/before:z
+ - ./data/conf/dovecot/global_sieve_after:/global_sieve/after:z
+ - ./data/assets/templates:/tpls:z
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ environment:
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ - LOG_LINES=${LOG_LINES:-9999}
+ - TZ=${TZ}
+ - DBNAME=${DBNAME}
+ - DBUSER=${DBUSER}
+ - DBPASS=${DBPASS}
+ - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+ - IMAP_PORT=${IMAP_PORT:-143}
+ - IMAPS_PORT=${IMAPS_PORT:-993}
+ - POP_PORT=${POP_PORT:-110}
+ - POPS_PORT=${POPS_PORT:-995}
+ - SIEVE_PORT=${SIEVE_PORT:-4190}
+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
+ - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+ - SUBMISSION_PORT=${SUBMISSION_PORT:-587}
+ - SMTPS_PORT=${SMTPS_PORT:-465}
+ - SMTP_PORT=${SMTP_PORT:-25}
+ - API_KEY=${API_KEY:-invalid}
+ - API_KEY_READ_ONLY=${API_KEY_READ_ONLY:-invalid}
+ - API_ALLOW_FROM=${API_ALLOW_FROM:-invalid}
+ - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+ - SKIP_SOLR=${SKIP_SOLR:-y}
+ - SKIP_CLAMD=${SKIP_CLAMD:-n}
+ - SKIP_SOGO=${SKIP_SOGO:-n}
+ - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+ - MASTER=${MASTER:-y}
+ restart: always
+ networks:
+ mailcow-network:
+ aliases:
+ - phpfpm
+
+ sogo-mailcow:
+ image: mailcow/sogo:1.91
+ environment:
+ - DBNAME=${DBNAME}
+ - DBUSER=${DBUSER}
+ - DBPASS=${DBPASS}
+ - TZ=${TZ}
+ - LOG_LINES=${LOG_LINES:-9999}
+ - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+ - ACL_ANYONE=${ACL_ANYONE:-disallow}
+ - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
+ - SOGO_EXPIRE_SESSION=${SOGO_EXPIRE_SESSION:-480}
+ - SKIP_SOGO=${SKIP_SOGO:-n}
+ - MASTER=${MASTER:-y}
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ volumes:
+ - ./data/conf/sogo/:/etc/sogo/:z
+ - ./data/web/inc/init_db.inc.php:/init_db.inc.php:Z
+ - ./data/conf/sogo/custom-sogo.js:/usr/lib/GNUstep/SOGo/WebServerResources/js/custom-sogo.js:z
+ - mysql-socket-vol-1:/var/run/mysqld/:z
+ - sogo-web-vol-1:/sogo_web:z
+ - sogo-userdata-backup-vol-1:/sogo_backup:Z
+ restart: always
+ networks:
+ mailcow-network:
+ ipv4_address: ${IPV4_NETWORK:-172.22.1}.248
+ aliases:
+ - sogo
+
+ dovecot-mailcow:
+ image: mailcow/dovecot:1.136
+ depends_on:
+ - mysql-mailcow
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ cap_add:
+ - NET_BIND_SERVICE
+ volumes:
+ - ./data/hooks/dovecot:/hooks:Z
+ - ./data/conf/dovecot:/etc/dovecot:z
+ - ./data/assets/ssl:/etc/ssl/mail/:ro,z
+ - ./data/conf/sogo/:/etc/sogo/:z
+ - ./data/conf/phpfpm/sogo-sso/:/etc/phpfpm/:z
+ - vmail-vol-1:/var/vmail:Z
+ - vmail-index-vol-1:/var/vmail_index:Z
+ - crypt-vol-1:/mail_crypt/:z
+ - ./data/conf/rspamd/custom/:/etc/rspamd/custom:z
+ - ./data/assets/templates:/templates:z
+ - rspamd-vol-1:/var/lib/rspamd:z
+ - mysql-socket-vol-1:/var/run/mysqld/:z
+ environment:
+ - DOVECOT_MASTER_USER=${DOVECOT_MASTER_USER:-}
+ - DOVECOT_MASTER_PASS=${DOVECOT_MASTER_PASS:-}
+ - LOG_LINES=${LOG_LINES:-9999}
+ - DBNAME=${DBNAME}
+ - DBUSER=${DBUSER}
+ - DBPASS=${DBPASS}
+ - TZ=${TZ}
+ - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
+ - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+ - MAILDIR_GC_TIME=${MAILDIR_GC_TIME:-1440}
+ - ACL_ANYONE=${ACL_ANYONE:-disallow}
+ - SKIP_SOLR=${SKIP_SOLR:-y}
+ - MAILDIR_SUB=${MAILDIR_SUB:-}
+ - MASTER=${MASTER:-y}
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+ ports:
+ - "${DOVEADM_PORT:-127.0.0.1:19991}:12345"
+ - "${IMAP_PORT:-143}:143"
+ - "${IMAPS_PORT:-993}:993"
+ - "${POP_PORT:-110}:110"
+ - "${POPS_PORT:-995}:995"
+ - "${SIEVE_PORT:-4190}:4190"
+ restart: always
+ tty: true
+ ulimits:
+ nproc: 65535
+ nofile:
+ soft: 20000
+ hard: 40000
+ hostname: ${MAILCOW_HOSTNAME}
+ networks:
+ mailcow-network:
+ ipv4_address: ${IPV4_NETWORK:-172.22.1}.250
+ aliases:
+ - dovecot
+
+ postfix-mailcow:
+ image: mailcow/postfix:1.57
+ depends_on:
+ - mysql-mailcow
+ volumes:
+ - ./data/hooks/postfix:/hooks:Z
+ - ./data/conf/postfix:/opt/postfix/conf:z
+ - ./data/assets/ssl:/etc/ssl/mail/:ro,z
+ - postfix-vol-1:/var/spool/postfix:z
+ - crypt-vol-1:/var/lib/zeyple:z
+ - rspamd-vol-1:/var/lib/rspamd:z
+ - mysql-socket-vol-1:/var/run/mysqld/:z
+ environment:
+ - LOG_LINES=${LOG_LINES:-9999}
+ - TZ=${TZ}
+ - DBNAME=${DBNAME}
+ - DBUSER=${DBUSER}
+ - DBPASS=${DBPASS}
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ cap_add:
+ - NET_BIND_SERVICE
+ ports:
+ - "${SMTP_PORT:-25}:25"
+ - "${SMTPS_PORT:-465}:465"
+ - "${SUBMISSION_PORT:-587}:587"
+ restart: always
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ hostname: ${MAILCOW_HOSTNAME}
+ networks:
+ mailcow-network:
+ aliases:
+ - postfix
+
+ memcached-mailcow:
+ image: memcached:alpine
+ restart: always
+ environment:
+ - TZ=${TZ}
+ networks:
+ mailcow-network:
+ aliases:
+ - memcached
+
+ nginx-mailcow:
+ depends_on:
+ - sogo-mailcow
+ - php-fpm-mailcow
+ - redis-mailcow
+ image: nginx:mainline-alpine
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ command: /bin/sh -c "envsubst < /etc/nginx/conf.d/templates/listen_plain.template > /etc/nginx/conf.d/listen_plain.active &&
+ envsubst < /etc/nginx/conf.d/templates/listen_ssl.template > /etc/nginx/conf.d/listen_ssl.active &&
+ envsubst < /etc/nginx/conf.d/templates/server_name.template > /etc/nginx/conf.d/server_name.active &&
+ envsubst < /etc/nginx/conf.d/templates/sogo.template > /etc/nginx/conf.d/sogo.active &&
+ . /etc/nginx/conf.d/templates/sogo.auth_request.template.sh > /etc/nginx/conf.d/sogo_proxy_auth.active &&
+ . /etc/nginx/conf.d/templates/sites.template.sh > /etc/nginx/conf.d/sites.active &&
+ . /etc/nginx/conf.d/templates/sogo_eas.template.sh > /etc/nginx/conf.d/sogo_eas.active &&
+ nginx -qt &&
+ until ping phpfpm -c1 > /dev/null; do sleep 1; done &&
+ until ping sogo -c1 > /dev/null; do sleep 1; done &&
+ until ping redis -c1 > /dev/null; do sleep 1; done &&
+ until ping rspamd -c1 > /dev/null; do sleep 1; done &&
+ exec nginx -g 'daemon off;'"
+ environment:
+ - HTTPS_PORT=${HTTPS_PORT:-443}
+ - HTTP_PORT=${HTTP_PORT:-80}
+ - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
+ - TZ=${TZ}
+ - SKIP_SOGO=${SKIP_SOGO:-n}
+ - ALLOW_ADMIN_EMAIL_LOGIN=${ALLOW_ADMIN_EMAIL_LOGIN:-n}
+ volumes:
+ - ./data/web:/web:ro,z
+ - ./data/conf/rspamd/dynmaps:/dynmaps:ro,z
+ - ./data/assets/ssl/:/etc/ssl/mail/:ro,z
+ - ./data/conf/nginx/:/etc/nginx/conf.d/:rw,Z
+ - ./data/conf/rspamd/meta_exporter:/meta_exporter:ro,z
+ - sogo-web-vol-1:/usr/lib/GNUstep/SOGo/:z
+ ports:
+ - "${HTTPS_BIND:-0.0.0.0}:${HTTPS_PORT:-443}:${HTTPS_PORT:-443}"
+ - "${HTTP_BIND:-0.0.0.0}:${HTTP_PORT:-80}:${HTTP_PORT:-80}"
+ restart: always
+ networks:
+ mailcow-network:
+ aliases:
+ - nginx
+
+ acme-mailcow:
+ depends_on:
+ - nginx-mailcow
+ image: mailcow/acme:1.76
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ environment:
+ - LOG_LINES=${LOG_LINES:-9999}
+ - ADDITIONAL_SAN=${ADDITIONAL_SAN}
+ - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+ - DBNAME=${DBNAME}
+ - DBUSER=${DBUSER}
+ - DBPASS=${DBPASS}
+ - SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
+ - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+ - DIRECTORY_URL=${DIRECTORY_URL:-}
+ - ENABLE_SSL_SNI=${ENABLE_SSL_SNI:-n}
+ - SKIP_IP_CHECK=${SKIP_IP_CHECK:-n}
+ - SKIP_HTTP_VERIFICATION=${SKIP_HTTP_VERIFICATION:-n}
+ - ONLY_MAILCOW_HOSTNAME=${ONLY_MAILCOW_HOSTNAME:-n}
+ - LE_STAGING=${LE_STAGING:-n}
+ - TZ=${TZ}
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
+ - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
+ volumes:
+ - ./data/web/.well-known/acme-challenge:/var/www/acme:rw,z
+ - ./data/assets/ssl:/var/lib/acme/:rw,z
+ - ./data/assets/ssl-example:/var/lib/ssl-example/:ro,Z
+ - mysql-socket-vol-1:/var/run/mysqld/:z
+ restart: always
+ networks:
+ mailcow-network:
+ aliases:
+ - acme
+
+ netfilter-mailcow:
+ image: mailcow/netfilter:1.38
+ stop_grace_period: 30s
+ depends_on:
+ - dovecot-mailcow
+ - postfix-mailcow
+ - sogo-mailcow
+ - php-fpm-mailcow
+ - redis-mailcow
+ restart: always
+ privileged: true
+ environment:
+ - TZ=${TZ}
+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
+ - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+ - SNAT_TO_SOURCE=${SNAT_TO_SOURCE:-n}
+ - SNAT6_TO_SOURCE=${SNAT6_TO_SOURCE:-n}
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ network_mode: "host"
+ volumes:
+ - /lib/modules:/lib/modules:ro
+
+ watchdog-mailcow:
+ image: mailcow/watchdog:1.85
+ # Debug
+ #command: /watchdog.sh
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ volumes:
+ - rspamd-vol-1:/var/lib/rspamd:z
+ - mysql-socket-vol-1:/var/run/mysqld/:z
+ - postfix-vol-1:/var/spool/postfix:z
+ - ./data/assets/ssl:/etc/ssl/mail/:ro,z
+ restart: always
+ environment:
+ - IPV6_NETWORK=${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+ - LOG_LINES=${LOG_LINES:-9999}
+ - TZ=${TZ}
+ - DBNAME=${DBNAME}
+ - DBUSER=${DBUSER}
+ - DBPASS=${DBPASS}
+ - DBROOT=${DBROOT}
+ - USE_WATCHDOG=${USE_WATCHDOG:-n}
+ - WATCHDOG_NOTIFY_EMAIL=${WATCHDOG_NOTIFY_EMAIL}
+ - WATCHDOG_NOTIFY_BAN=${WATCHDOG_NOTIFY_BAN:-y}
+ - WATCHDOG_EXTERNAL_CHECKS=${WATCHDOG_EXTERNAL_CHECKS:-n}
+ - WATCHDOG_MYSQL_REPLICATION_CHECKS=${WATCHDOG_MYSQL_REPLICATION_CHECKS:-n}
+ - MAILCOW_HOSTNAME=${MAILCOW_HOSTNAME}
+ - COMPOSE_PROJECT_NAME=${COMPOSE_PROJECT_NAME:-mailcow-dockerized}
+ - IPV4_NETWORK=${IPV4_NETWORK:-172.22.1}
+ - IP_BY_DOCKER_API=${IP_BY_DOCKER_API:-0}
+ - CHECK_UNBOUND=${CHECK_UNBOUND:-1}
+ - SKIP_CLAMD=${SKIP_CLAMD:-n}
+ - SKIP_LETS_ENCRYPT=${SKIP_LETS_ENCRYPT:-n}
+ - SKIP_SOGO=${SKIP_SOGO:-n}
+ - HTTPS_PORT=${HTTPS_PORT:-443}
+ - REDIS_SLAVEOF_IP=${REDIS_SLAVEOF_IP:-}
+ - REDIS_SLAVEOF_PORT=${REDIS_SLAVEOF_PORT:-}
+ - EXTERNAL_CHECKS_THRESHOLD=1
+ - NGINX_THRESHOLD=5
+ - UNBOUND_THRESHOLD=5
+ - REDIS_THRESHOLD=5
+ - MYSQL_THRESHOLD=5
+ - MYSQL_REPLICATION_THRESHOLD=1
+ - SOGO_THRESHOLD=3
+ - POSTFIX_THRESHOLD=8
+ - CLAMD_THRESHOLD=15
+ - DOVECOT_THRESHOLD=12
+ - DOVECOT_REPL_THRESHOLD=20
+ - PHPFPM_THRESHOLD=5
+ - RATELIMIT_THRESHOLD=1
+ - FAIL2BAN_THRESHOLD=1
+ - ACME_THRESHOLD=1
+ - IPV6NAT_THRESHOLD=1
+ - RSPAMD_THRESHOLD=5
+ - OLEFY_THRESHOLD=5
+ - MAILQ_THRESHOLD=20
+ - MAILQ_CRIT=30
+ networks:
+ mailcow-network:
+ aliases:
+ - watchdog
+
+ dockerapi-mailcow:
+ image: mailcow/dockerapi:1.37
+ security_opt:
+ - label=disable
+ restart: always
+ oom_kill_disable: true
+ dns:
+ - ${IPV4_NETWORK:-172.22.1}.254
+ environment:
+ - DBROOT=${DBROOT}
+ - TZ=${TZ}
+ volumes:
+ - /var/run/docker.sock:/var/run/docker.sock:ro
+ networks:
+ mailcow-network:
+ aliases:
+ - dockerapi
+
+ solr-mailcow:
+ image: mailcow/solr:1.7
+ restart: always
+ volumes:
+ - solr-vol-1:/opt/solr/server/solr/dovecot-fts/data:Z
+ ports:
+ - "${SOLR_PORT:-127.0.0.1:18983}:8983"
+ environment:
+ - TZ=${TZ}
+ - SOLR_HEAP=${SOLR_HEAP:-1024}
+ - SKIP_SOLR=${SKIP_SOLR:-y}
+ networks:
+ mailcow-network:
+ aliases:
+ - solr
+
+ olefy-mailcow:
+ image: mailcow/olefy:1.5
+ restart: always
+ environment:
+ - TZ=${TZ}
+ - OLEFY_BINDADDRESS=0.0.0.0
+ - OLEFY_BINDPORT=10055
+ - OLEFY_TMPDIR=/tmp
+ - OLEFY_PYTHON_PATH=/usr/bin/python3
+ - OLEFY_OLEVBA_PATH=/usr/bin/olevba3
+ - OLEFY_LOGLVL=20
+ - OLEFY_MINLENGTH=500
+ - OLEFY_DEL_TMP=1
+ networks:
+ mailcow-network:
+ aliases:
+ - olefy
+
+ ipv6nat-mailcow:
+ depends_on:
+ - unbound-mailcow
+ - mysql-mailcow
+ - redis-mailcow
+ - clamd-mailcow
+ - rspamd-mailcow
+ - php-fpm-mailcow
+ - sogo-mailcow
+ - dovecot-mailcow
+ - postfix-mailcow
+ - memcached-mailcow
+ - nginx-mailcow
+ - acme-mailcow
+ - netfilter-mailcow
+ - watchdog-mailcow
+ - dockerapi-mailcow
+ - solr-mailcow
+ environment:
+ - TZ=${TZ}
+ image: robbertkl/ipv6nat
+ security_opt:
+ - label=disable
+ restart: always
+ privileged: true
+ network_mode: "host"
+ volumes:
+ - /var/run/docker.sock:/var/run/docker.sock:ro
+ - /lib/modules:/lib/modules:ro
+
+networks:
+ mailcow-network:
+ driver: bridge
+ driver_opts:
+ com.docker.network.bridge.name: br-mailcow
+ enable_ipv6: true
+ ipam:
+ driver: default
+ config:
+ - subnet: ${IPV4_NETWORK:-172.22.1}.0/24
+ - subnet: ${IPV6_NETWORK:-fd4d:6169:6c63:6f77::/64}
+
+volumes:
+ vmail-vol-1:
+ vmail-index-vol-1:
+ mysql-vol-1:
+ mysql-socket-vol-1:
+ redis-vol-1:
+ rspamd-vol-1:
+ solr-vol-1:
+ postfix-vol-1:
+ crypt-vol-1:
+ sogo-web-vol-1:
+ sogo-userdata-backup-vol-1:
diff --git a/webserver/docker_mail/templates/mailcow-dockerized/mailcow.conf b/webserver/docker_mail/templates/mailcow-dockerized/mailcow.conf
new file mode 100644
index 0000000000000000000000000000000000000000..fb28f40f99232ff91a9802955a4dc6392b24d5a1
--- /dev/null
+++ b/webserver/docker_mail/templates/mailcow-dockerized/mailcow.conf
@@ -0,0 +1,202 @@
+# ------------------------------
+# mailcow web ui configuration
+# ------------------------------
+# example.org is _not_ a valid hostname, use a fqdn here.
+# Default admin user is "admin"
+# Default password is "moohoo"
+
+MAILCOW_HOSTNAME=mailserver.warpzone.ms
+
+# ------------------------------
+# SQL database configuration
+# ------------------------------
+
+DBNAME=mailcow
+DBUSER=mailcow
+
+# Please use long, random alphanumeric strings (A-Za-z0-9)
+
+DBPASS={{ mysql_mailcow_pass }}
+DBROOT={{ mysql_root_pass }}
+
+# ------------------------------
+# HTTP/S Bindings
+# ------------------------------
+
+# You should use HTTPS, but in case of SSL offloaded reverse proxies:
+# Might be important: This will also change the binding within the container.
+# If you use a proxy within Docker, point it to the ports you set below.
+# Do _not_ use IP:PORT in HTTP(S)_BIND or HTTP(S)_PORT
+# IMPORTANT: Do not use port 8081, 9081 or 65510!
+
+HTTP_PORT=42012
+HTTP_BIND=127.0.0.1
+
+HTTPS_PORT=42013
+HTTPS_BIND=127.0.0.1
+
+# ------------------------------
+# Other bindings
+# ------------------------------
+# You should leave that alone
+# Format: 11.22.33.44:25 or 0.0.0.0:465 etc.
+
+SMTP_PORT=25
+SMTPS_PORT=465
+SUBMISSION_PORT=587
+IMAP_PORT=143
+IMAPS_PORT=993
+POP_PORT=110
+POPS_PORT=995
+SIEVE_PORT=4190
+DOVEADM_PORT=127.0.0.1:19991
+SQL_PORT=127.0.0.1:23306
+SOLR_PORT=127.0.0.1:18983
+REDIS_PORT=127.0.0.1:7654
+
+# Your timezone
+
+TZ=Europe/Berlin
+
+# Fixed project name
+# Please use lowercase letters only
+
+COMPOSE_PROJECT_NAME=mail
+
+# Set this to "allow" to enable the anyone pseudo user. Disabled by default.
+# When enabled, ACL can be created, that apply to "All authenticated users"
+# This should probably only be activated on mail hosts, that are used exclusivly by one organisation.
+# Otherwise a user might share data with too many other users.
+ACL_ANYONE=disallow
+
+# Garbage collector cleanup
+# Deleted domains and mailboxes are moved to /var/vmail/_garbage/timestamp_sanitizedstring
+# How long should objects remain in the garbage until they are being deleted? (value in minutes)
+# Check interval is hourly
+
+MAILDIR_GC_TIME=7200
+
+# Additional SAN for the certificate
+#
+# You can use wildcard records to create specific names for every domain you add to mailcow.
+# Example: Add domains "example.com" and "example.net" to mailcow, change ADDITIONAL_SAN to a value like:
+#ADDITIONAL_SAN=imap.*,smtp.*
+# This will expand the certificate to "imap.example.com", "smtp.example.com", "imap.example.net", "imap.example.net"
+# plus every domain you add in the future.
+#
+# You can also just add static names...
+#ADDITIONAL_SAN=srv1.example.net
+# ...or combine wildcard and static names:
+#ADDITIONAL_SAN=imap.*,srv1.example.com
+#
+
+ADDITIONAL_SAN=
+
+# Skip running ACME (acme-mailcow, Let's Encrypt certs) - y/n
+
+SKIP_LETS_ENCRYPT=y
+
+# Create seperate certificates for all domains - y/n
+# this will allow adding more than 100 domains, but some email clients will not be able to connect with alternative hostnames
+# see https://wiki.dovecot.org/SSL/SNIClientSupport
+ENABLE_SSL_SNI=n
+
+# Skip IPv4 check in ACME container - y/n
+
+SKIP_IP_CHECK=n
+
+# Skip HTTP verification in ACME container - y/n
+
+SKIP_HTTP_VERIFICATION=n
+
+# Skip ClamAV (clamd-mailcow) anti-virus (Rspamd will auto-detect a missing ClamAV container) - y/n
+
+SKIP_CLAMD=y
+
+# Skip SOGo: Will disable SOGo integration and therefore webmail, DAV protocols and ActiveSync support (experimental, unsupported, not fully implemented) - y/n
+
+SKIP_SOGO=y
+
+# Skip Solr on low-memory systems or if you do not want to store a readable index of your mails in solr-vol-1.
+
+SKIP_SOLR=y
+
+# Solr heap size in MB, there is no recommendation, please see Solr docs.
+# Solr is a prone to run OOM and should be monitored. Unmonitored Solr setups are not recommended.
+
+SOLR_HEAP=1024
+
+# Allow admins to log into SOGo as email user (without any password)
+
+ALLOW_ADMIN_EMAIL_LOGIN=n
+
+# Enable watchdog (watchdog-mailcow) to restart unhealthy containers
+
+USE_WATCHDOG=y
+
+# Send watchdog notifications by mail (sent from watchdog@MAILCOW_HOSTNAME)
+# CAUTION:
+# 1. You should use external recipients
+# 2. Mails are sent unsigned (no DKIM)
+# 3. If you use DMARC, create a separate DMARC policy ("v=DMARC1; p=none;" in _dmarc.MAILCOW_HOSTNAME)
+# Multiple rcpts allowed, NO quotation marks, NO spaces
+
+#WATCHDOG_NOTIFY_EMAIL=a@example.com,b@example.com,c@example.com
+#WATCHDOG_NOTIFY_EMAIL=
+
+# Notify about banned IP (includes whois lookup)
+WATCHDOG_NOTIFY_BAN=n
+
+# Checks if mailcow is an open relay. Requires a SAL. More checks will follow.
+# https://www.servercow.de/mailcow?lang=en
+# https://www.servercow.de/mailcow?lang=de
+# No data is collected. Opt-in and anonymous.
+# Will only work with unmodified mailcow setups.
+WATCHDOG_EXTERNAL_CHECKS=y
+
+# Max log lines per service to keep in Redis logs
+
+LOG_LINES=9999
+
+# Internal IPv4 /24 subnet, format n.n.n (expands to n.n.n.0/24)
+# Use private IPv4 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv4_addresses
+
+IPV4_NETWORK=192.168.0
+
+# Internal IPv6 subnet in fc00::/7
+# Use private IPv6 addresses only, see https://en.wikipedia.org/wiki/Private_network#Private_IPv6_addresses
+
+IPV6_NETWORK=fd4d:dead:beef:2342::/64
+
+# Use this IPv4 for outgoing connections (SNAT)
+
+#SNAT_TO_SOURCE=
+
+# Use this IPv6 for outgoing connections (SNAT)
+
+#SNAT6_TO_SOURCE=
+
+# Create or override an API key for the web UI
+# You _must_ define API_ALLOW_FROM, which is a comma separated list of IPs
+# An API key defined as API_KEY has read-write access
+# An API key defined as API_KEY_READ_ONLY has read-only access
+# Allowed chars for API_KEY and API_KEY_READ_ONLY: a-z, A-Z, 0-9, -
+# You can define API_KEY and/or API_KEY_READ_ONLY
+
+#API_KEY=
+#API_KEY_READ_ONLY=
+#API_ALLOW_FROM=172.22.1.1,127.0.0.1
+
+# mail_home is ~/Maildir
+MAILDIR_SUB=Maildir
+
+# SOGo session timeout in minutes
+SOGO_EXPIRE_SESSION=480
+
+# DOVECOT_MASTER_USER and DOVECOT_MASTER_PASS must both be provided. No special chars.
+# Empty by default to auto-generate master user and password on start.
+# User expands to DOVECOT_MASTER_USER@mailcow.local
+# LEAVE EMPTY IF UNSURE
+DOVECOT_MASTER_USER=
+# LEAVE EMPTY IF UNSURE
+DOVECOT_MASTER_PASS=